Definition: intrusion: A formal term describing the act of compromising a system. Contrast: intrusion prevention Protect the system, such as using access control. intrusion detection Second line of defense, detecting either failed attempts to compromise the system or often successful ones. intrusion recovery After a system has been compromised in a security incident, what steps need to be taken to recover the system (such as restoring from backups). Intrusion recovery is related to general disaster recovery. Contrast: physical intrusion Given enough time, somebody with physical access to a computer will be able to break in. One way would be to turn the power off and boot from a floppy or CD-ROM. Another way would be to remove the disk drive from the machine. local intrusion Users who can log on to the machine with one user account can often attack the system in order to gain root/administrator privileges. This is more often a concern for Unix systems than Windows. Note that even though it is called a "local" intrusion, the user may still be remotely connected to the computer. remote intrusion An intrusion where the attacker does not have any other access to the box except to be able to send packets at it. Most of what people think of "hacking" on the Internet is remote intrusions. From Hacking-Lexicon

